# Audit my project's dependencies for security risks and bloat

A prioritized review of outdated, vulnerable, duplicated, and unused packages, with a safe update order and lockfile hygiene.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Coding, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/audit-my-project-s-dependencies-for-security-risks-and-bloat

## Prompt

```text
Audit the dependencies in my software project.

**Language and package manager:** [e.g. "Node with npm", "Python with Poetry", "Java with Maven"]
**Manifest and lockfile:** [paste package.json / pyproject.toml / pom.xml, and relevant lockfile sections]
**Output of audit or outdated commands:** [paste e.g. `npm audit`, `npm outdated`, `pip-audit`, Dependabot alerts]
**Runtime and deployment:** [e.g. "Node 20, deployed to Lambda", "Python 3.11 in Docker"]
**Test coverage:** [good / patchy / none]

Return:
1. **Vulnerabilities table:** Package | Version | Issue and severity | Reachable from our code? | Fix version | Breaking changes expected. Use only the advisories I pasted; do not invent CVE numbers. Where reachability is unclear, mark [CHECK].
2. **Outdated packages:** grouped as patch / minor / major, with known breaking-change areas to check in each changelog.
3. **Bloat and risk:** unused dependencies, packages that duplicate each other, dev dependencies shipped to production, unpinned or wildcard versions, unmaintained or single-maintainer packages, and suspicious names that could be typosquats.
4. **Conflicts:** any version conflicts or peer-dependency problems, with the cause and resolution options.
5. **Update plan:** a safe order of small batches, what to test after each, and how to roll back.
6. **Ongoing hygiene:** lockfile committed, automated update PRs, a CI audit step, and a policy for adding new packages.

Put the top 3 actions for this week at the top.
```

## What to fill in

- e.g. "Node with npm", "Python with Poetry", "Java with Maven"
- e.g. "Node 20, deployed to Lambda", "Python 3.11 in Docker"
- good / patchy / none
- CHECK

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.